210-255 · Question #193
Which expression allows you to filter on network numbers?
The correct answer is D. [tcp|udp] [src|dst] port <port>. This question covers tcpdump/libpcap BPF filter expression syntax; however, the marked correct answer D is a port filter, not a network number filter - option C is the expression that actually filters on network addresses.
Question
Which expression allows you to filter on network numbers?
Options
- Aether [src|dst] host <ehost>
- Bgateway host <host>
- C[src|dst] net <net> [{mask <mask>}|{len <len>}}
- D[tcp|udp] [src|dst] port <port>
How the community answered
(32 responses)- A3% (1)
- C3% (1)
- D94% (30)
Why each option
This question covers tcpdump/libpcap BPF filter expression syntax; however, the marked correct answer D is a port filter, not a network number filter - option C is the expression that actually filters on network addresses.
The `ether [src|dst] host <ehost>` expression filters on Ethernet MAC addresses at Layer 2, not on IP network numbers.
The `gateway host <host>` expression matches packets that used the specified host as a routing gateway, which is unrelated to filtering on network numbers.
Option C is actually the correct tcpdump expression for filtering on network numbers with optional subnet mask or prefix length, making it arguably the accurate answer to this question despite not being marked as such.
The expression `[tcp|udp] [src|dst] port <port>` filters traffic by TCP or UDP port number in tcpdump/libpcap BPF syntax. This is a port filter, not a network number filter - the marked correct answer appears to be an error in the source material, as option C (`[src|dst] net <net> [mask <mask>|len <len>]`) is the correct expression for filtering on network numbers.
Concept tested: tcpdump BPF network and port filter expressions
Source: https://www.tcpdump.org/manpages/pcap-filter.7.html
Topics
Community Discussion
No community discussion yet for this question.